mystic | ddc6b496a8a25762ee7b933f47107c5553187f5846568bf68b67dd8d5f4a7548

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

1LX47qe0.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1LX47qe0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1LX47qe0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1LX47qe0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1LX47qe0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1LX47qe0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1LX47qe0.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral8/memory/4616-74-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

5xV0bM2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	5xV0bM2.exe

Executes dropped EXE 8 IoCs

Processes:

Qv2gf41.exeeR2bd96.exeqO2jK92.exe1LX47qe0.exe2uI2241.exe3aw69dK.exe4WB743EI.exe5xV0bM2.exe

pid process

3384 Qv2gf41.exe
4208 eR2bd96.exe
892 qO2jK92.exe
4844 1LX47qe0.exe
4624 2uI2241.exe
3860 3aw69dK.exe
4892 4WB743EI.exe
4368 5xV0bM2.exe

pid	process
3384	Qv2gf41.exe
4208	eR2bd96.exe
892	qO2jK92.exe
4844	1LX47qe0.exe
4624	2uI2241.exe
3860	3aw69dK.exe
4892	4WB743EI.exe
4368	5xV0bM2.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

1LX47qe0.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1LX47qe0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1LX47qe0.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exeQv2gf41.exeeR2bd96.exeqO2jK92.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Qv2gf41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	eR2bd96.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	qO2jK92.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

2uI2241.exe3aw69dK.exe4WB743EI.exe

description	pid	process	target process
PID 4624 set thread context of 720	4624	2uI2241.exe	AppLaunch.exe
PID 3860 set thread context of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 4892 set thread context of 4616	4892	4WB743EI.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3364 4624 WerFault.exe 2uI2241.exe
3648 3860 WerFault.exe 3aw69dK.exe
1652 4892 WerFault.exe 4WB743EI.exe

pid	pid_target	process	target process
3364	4624	WerFault.exe	2uI2241.exe
3648	3860	WerFault.exe	3aw69dK.exe
1652	4892	WerFault.exe	4WB743EI.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AppLaunch.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

1LX47qe0.exemsedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4844	1LX47qe0.exe
4844	1LX47qe0.exe
4960	msedge.exe
4960	msedge.exe
5032	msedge.exe
5032	msedge.exe
4636	msedge.exe
4636	msedge.exe
3744	identity_helper.exe
3744	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4636 msedge.exe
4636 msedge.exe
4636 msedge.exe
4636 msedge.exe
4636 msedge.exe
4636 msedge.exe
4636 msedge.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1LX47qe0.exe

description pid process

Token: SeDebugPrivilege 4844 1LX47qe0.exe

description	pid	process
Token: SeDebugPrivilege	4844	1LX47qe0.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exeQv2gf41.exeeR2bd96.exeqO2jK92.exe2uI2241.exe3aw69dK.exe4WB743EI.exe5xV0bM2.execmd.exemsedge.exemsedge.exe

description	pid	process	target process
PID 1684 wrote to memory of 3384	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	Qv2gf41.exe
PID 1684 wrote to memory of 3384	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	Qv2gf41.exe
PID 1684 wrote to memory of 3384	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	Qv2gf41.exe
PID 3384 wrote to memory of 4208	3384	Qv2gf41.exe	eR2bd96.exe
PID 3384 wrote to memory of 4208	3384	Qv2gf41.exe	eR2bd96.exe
PID 3384 wrote to memory of 4208	3384	Qv2gf41.exe	eR2bd96.exe
PID 4208 wrote to memory of 892	4208	eR2bd96.exe	qO2jK92.exe
PID 4208 wrote to memory of 892	4208	eR2bd96.exe	qO2jK92.exe
PID 4208 wrote to memory of 892	4208	eR2bd96.exe	qO2jK92.exe
PID 892 wrote to memory of 4844	892	qO2jK92.exe	1LX47qe0.exe
PID 892 wrote to memory of 4844	892	qO2jK92.exe	1LX47qe0.exe
PID 892 wrote to memory of 4844	892	qO2jK92.exe	1LX47qe0.exe
PID 892 wrote to memory of 4624	892	qO2jK92.exe	2uI2241.exe
PID 892 wrote to memory of 4624	892	qO2jK92.exe	2uI2241.exe
PID 892 wrote to memory of 4624	892	qO2jK92.exe	2uI2241.exe
PID 4624 wrote to memory of 1616	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 1616	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 1616	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4624 wrote to memory of 720	4624	2uI2241.exe	AppLaunch.exe
PID 4208 wrote to memory of 3860	4208	eR2bd96.exe	3aw69dK.exe
PID 4208 wrote to memory of 3860	4208	eR2bd96.exe	3aw69dK.exe
PID 4208 wrote to memory of 3860	4208	eR2bd96.exe	3aw69dK.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3860 wrote to memory of 1448	3860	3aw69dK.exe	AppLaunch.exe
PID 3384 wrote to memory of 4892	3384	Qv2gf41.exe	4WB743EI.exe
PID 3384 wrote to memory of 4892	3384	Qv2gf41.exe	4WB743EI.exe
PID 3384 wrote to memory of 4892	3384	Qv2gf41.exe	4WB743EI.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 4892 wrote to memory of 4616	4892	4WB743EI.exe	AppLaunch.exe
PID 1684 wrote to memory of 4368	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	5xV0bM2.exe
PID 1684 wrote to memory of 4368	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	5xV0bM2.exe
PID 1684 wrote to memory of 4368	1684	2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe	5xV0bM2.exe
PID 4368 wrote to memory of 3516	4368	5xV0bM2.exe	cmd.exe
PID 4368 wrote to memory of 3516	4368	5xV0bM2.exe	cmd.exe
PID 3516 wrote to memory of 5080	3516	cmd.exe	msedge.exe
PID 3516 wrote to memory of 5080	3516	cmd.exe	msedge.exe
PID 3516 wrote to memory of 4636	3516	cmd.exe	msedge.exe
PID 3516 wrote to memory of 4636	3516	cmd.exe	msedge.exe
PID 5080 wrote to memory of 2208	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 2208	5080	msedge.exe	msedge.exe
PID 4636 wrote to memory of 5104	4636	msedge.exe	msedge.exe
PID 4636 wrote to memory of 5104	4636	msedge.exe	msedge.exe
PID 5080 wrote to memory of 4100	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 4100	5080	msedge.exe	msedge.exe
PID 5080 wrote to memory of 4100	5080	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe
"C:\Users\Admin\AppData\Local\Temp\2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qv2gf41.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qv2gf41.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR2bd96.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR2bd96.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4208

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qO2jK92.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qO2jK92.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1LX47qe0.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1LX47qe0.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uI2241.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2uI2241.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:1616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 604
6⤵
- Program crash
PID:3364

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3aw69dK.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\3aw69dK.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
- Checks SCSI registry key(s)
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 572
5⤵
- Program crash
PID:3648

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WB743EI.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4WB743EI.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 572
4⤵
- Program crash
PID:1652

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5xV0bM2.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5xV0bM2.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9AD8.tmp\9AD9.tmp\9ADA.bat C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5xV0bM2.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login
4⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffacf8346f8,0x7ffacf834708,0x7ffacf834718
5⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11623921941378345111,16316019880193846505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
5⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11623921941378345111,16316019880193846505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffacf8346f8,0x7ffacf834708,0x7ffacf834718
5⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
5⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
5⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
5⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
5⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
5⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
5⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
5⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
5⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
5⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
5⤵
PID:2680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,13146254763440805264,373947759842513978,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4624 -ip 4624
1⤵
PID:2028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3860 -ip 3860
1⤵
PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4892 -ip 4892
1⤵
PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery